@sap/eslint-plugin-cds 2.3.4 → 2.5.0

package/lib/rules/auth-valid-restrict-grant.js

@@ -0,0 +1,105 @@
+const { findFuzzy, isEmptyString, isEmptyObject, isStringInArray } = require("../utils/rules");
+
+const REPLACE_AS_WRITE_EVENTS = ["READ", "CREATE", "UPDATE", "DELETE"];
+const VALID_EVENTS = REPLACE_AS_WRITE_EVENTS.concat(["INSERT", "UPSERT", "WRITE", "*"]);
+
+module.exports = {
+  meta: {
+    docs: {
+      description: "`@restrict.grant` must have valid values.",
+      category: "Model Validation",
+      recommended: true
+    },
+    messages: {
+      InvalidItem: `Invalid item '{{invalid}}'. Did you mean '{{candidates}}'?`,
+      ReplaceItemWith: `Replace '{{invalid}}' with '{{candidates}}'`
+    },
+    type: "problem",
+    model: "inferred"
+  },
+  create(context) {
+    return {
+      entity: check_restrict_grant
+    };
+
+    function check_restrict_grant(e) {
+      const node = context.getNode(e);
+      const file = e.$location.file;
+      if (e["@restrict"]) {
+        const actions = e.actions;
+        const actionNames = actions ? Object.keys(actions).map((s) => actions[s].name) : [];
+        const validEventsAndActions = VALID_EVENTS.concat(actionNames);
+
+        for (const entry of e["@restrict"]) {
+          if (Object.keys(entry).includes("grant")) {
+            const grantValue = entry.grant;
+            switch (typeof grantValue) {
+              case "string": {
+                if (isEmptyString(grantValue)) {
+                  context.report({
+                    message: `Missing event/action on ${e.name} for \`@restrict.grant\`.`,
+                    node,
+                    file
+                  });
+                } else {
+                  if (!isStringInArray(grantValue, validEventsAndActions, true)) {
+                    const candidates = findFuzzy(grantValue, validEventsAndActions.sort());
+                    context.report({
+                      messageId: "InvalidItem",
+                      data: { invalid: grantValue, candidates },
+                      node,
+                      file
+                    });
+                  }
+                }
+                break;
+              }
+
+              case "object":
+                if (isEmptyObject(grantValue)) {
+                  context.report({
+                    message: `Missing event/action on ${e.name} for \`@restrict.grant\`.`,
+                    node,
+                    file
+                  });
+                } else {
+                  let valuesForWrite = grantValue.filter(function (item) {
+                    return item !== "READ" && item !== "WRITE" && item !== "*";
+                  });
+                  for (const value of grantValue) {
+                    if (!validEventsAndActions.includes(value)) {
+                      const candidates = findFuzzy(value, validEventsAndActions.sort());
+                      context.report({
+                        messageId: "InvalidItem",
+                        data: { invalid: value, candidates },
+                        node,
+                        file
+                      });
+                    }
+                  }
+                  let allValuesIncluded = grantValue.every((v) => valuesForWrite.includes(v));
+                  if (allValuesIncluded) {
+                    context.report({
+                      messageId: "InvalidItem",
+                      data: { invalid: [`[${grantValue}]`], candidates: [`["WRITE"]`] },
+                      node,
+                      file
+                    });
+                  }
+                  if (grantValue.includes("*")) {
+                    context.report({
+                      messageId: "InvalidItem",
+                      data: { invalid: `[${grantValue}]`, candidates: [`["*"]`] },
+                      node,
+                      file
+                    });
+                  }
+                }
+                break;
+            }
+          }
+        }
+      }
+    }
+  }
+};

package/lib/rules/auth-valid-restrict-keys.js

@@ -0,0 +1,43 @@
+const { isEmptyObject, findFuzzy } = require("../utils/rules");
+
+const VALID_RESTRICT_KEYS = ["grant", "to", "where"];
+
+module.exports = {
+  meta: {
+    docs: {
+      description: "`@restrict` must have properly spelled `to`, `grant`, and `where` keys.",
+      category: "Model Validation",
+      recommended: true
+    },
+    messages: {
+      InvalidItem: `Misspelled key '{{invalid}}'. Did you mean '{{candidates}}'?`
+    },
+    type: "problem",
+    model: "inferred"
+  },
+  create(context) {
+    return {
+      entity: check_restrict_keys
+    };
+
+    function check_restrict_keys(e) {
+      if (e["@restrict"]) {
+        for (const entry of e["@restrict"]) {
+          if (typeof entry === "object" && !isEmptyObject(entry)) {
+            for (const key of Object.keys(entry)) {
+              if (!VALID_RESTRICT_KEYS.includes(key)) {
+                const candidates = findFuzzy(key, VALID_RESTRICT_KEYS.sort());
+                context.report({
+                  messageId: "InvalidItem",
+                  data: { invalid: key, candidates },
+                  node: context.getNode(e),
+                  file: e.$location.file
+                });
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+};

package/lib/rules/auth-valid-restrict-to.js

@@ -0,0 +1,130 @@
+const { isEmptyString, isStringInArray, findFuzzy, splitEntityName, isEmptyObject } = require("../utils/rules");
+
+const VALID_PSEUDO_ROLES = ["authenticated-user", "system-user", "any"];
+
+module.exports = {
+  meta: {
+    docs: {
+      description: "`@restrict.to` must have valid values.",
+      category: "Model Validation",
+      recommended: true
+    },
+    hasSuggestions: true,
+    messages: {
+      InvalidItem: `Invalid item '{{invalid}}'. Did you mean '{{candidates}}'?`,
+      ReplaceItemWith: `Replace '{{invalid}}' with '{{candidates}}'`
+    },
+    type: "problem",
+    model: "inferred"
+  },
+  create(context) {
+    return {
+      entity: check_restrict_to
+    };
+
+    function check_restrict_to(e) {
+      const USER_ROLES = [];
+      const model = context.getModel();
+
+      model.foreach("entity", (e) => {
+        if (e["@restrict"]) {
+          e["@restrict"].forEach((p) => {
+            if (p.to) {
+              switch (typeof p.to) {
+                case "string":
+                  if (p.to !== p.to.toLowerCase() && !USER_ROLES.includes(p.to)) {
+                    USER_ROLES.push(p.to);
+                  }
+                  break;
+                case "object":
+                  for (const r in p.to) {
+                    if (r !== r.toLowerCase() && !USER_ROLES.includes(r)) {
+                      USER_ROLES.push(r);
+                    }
+                  }
+              }
+            }
+          });
+        }
+      });
+      const ROLES = USER_ROLES.concat(VALID_PSEUDO_ROLES);
+
+      if (e["@restrict"]) {
+        let node = context.getNode(e);
+        let file = e.$location.file;
+        const { prefix } = splitEntityName(e);
+        const prefixSplit = prefix.split(".");
+        const serviceName = prefixSplit[prefixSplit.length - 1];
+        let services = model.services;
+
+        // TODO: For hierachies, check whether service restriction exists
+        //let grantAllTo;
+        Object.values(services).map((s) => {
+          if (s.name === serviceName && s["@requires"]) {
+            //grantAllTo = s['@requires'];
+          }
+        });
+
+        for (const entry of e["@restrict"]) {
+          if (Object.keys(entry).includes("to")) {
+            const toValue = entry.to;
+
+            switch (typeof toValue) {
+              case "string": {
+                if (isEmptyString(toValue)) {
+                  context.report({
+                    message: `Missing role on ${e.name} for \`@restrict.to\`.`,
+                    node,
+                    file
+                  });
+                } else {
+                  const isPseudoRole = entry.to && entry.to === entry.to.toLowerCase();
+                  if (!isStringInArray(toValue, ROLES, isPseudoRole)) {
+                    const candidates = findFuzzy(toValue, ROLES.sort());
+                    context.report({
+                      messageId: "InvalidItem",
+                      data: { invalid: toValue, candidates },
+                      node,
+                      file
+                    });
+                  }
+                }
+                break;
+              }
+
+              case "object":
+                if (isEmptyObject(toValue)) {
+                  context.report({
+                    message: `Missing roles on ${e.name} for \`@restrict.to\`.`,
+                    node,
+                    file
+                  });
+                } else {
+                  if (toValue.includes("any")) {
+                    context.report({
+                      messageId: "InvalidItem",
+                      data: { invalid: `[${toValue}]`, candidates: [`["any"]`] },
+                      node,
+                      file
+                    });
+                  }
+                  toValue.forEach((value) => {
+                    if (!ROLES.includes(value)) {
+                      const candidates = findFuzzy(value, ROLES.sort());
+                      context.report({
+                        messageId: "InvalidItem",
+                        data: { invalid: value, candidates },
+                        node,
+                        file
+                      });
+                    }
+                  });
+                }
+                break;
+            }
+          }
+        }
+      }
+    }
+  }
+};

package/lib/rules/auth-valid-restrict-where.js

@@ -0,0 +1,89 @@
+const cds = require("@sap/cds");
+
+const VALID_PSEUDO_ROLES = ["authenticated-user", "system-user", "any"];
+
+module.exports = {
+  meta: {
+    docs: {
+      description: "`@restrict.where` must have valid values.",
+      category: "Model Validation",
+      recommended: true
+    },
+    severity: "error",
+    hasSuggestions: true,
+    messages: {
+      InvalidItem: `Invalid item '{{invalid}}'. Did you mean '{{candidates}}'?`,
+      ReplaceItemWith: `Replace '{{invalid}}' with '{{candidates}}'`
+    },
+    type: "problem",
+    model: "inferred"
+  },
+  create(context) {
+    const model = context.getModel();
+
+    return {
+      entity: check_restrict_grant
+    };
+
+    function check_restrict_grant(e) {
+      const USER_ROLES = [];
+
+      model.foreach("entity", (e) => {
+        if (e["@restrict"]) {
+          e["@restrict"].forEach((p) => {
+            if (p.to) {
+              switch (typeof p.to) {
+                case "string":
+                  if (p.to !== p.to.toLowerCase() && !USER_ROLES.includes(p.to)) {
+                    USER_ROLES.push(p.to);
+                  }
+                  break;
+                case "object":
+                  for (const r in p.to) {
+                    if (r !== r.toLowerCase() && !USER_ROLES.includes(r)) {
+                      USER_ROLES.push(r);
+                    }
+                  }
+              }
+            }
+          });
+        }
+      });
+      const ROLES = USER_ROLES.concat(VALID_PSEUDO_ROLES);
+
+      if (e["@restrict"]) {
+        const node = context.getNode(e);
+        const file = e.$location.file;
+        for (const entry of e["@restrict"]) {
+          const whereValues = entry.where;
+          if (whereValues && typeof whereValues === "string") {
+            let cxn;
+            try {
+              cxn = cds.parse.expr(entry.where);
+            } catch (err) {
+              context.report({
+                message: `Invalid \`where\` expression, CDS compilation failed.`,
+                node,
+                file
+              });
+            }
+            if (cxn && cxn.xpr) {
+              const operator = cxn.xpr[1];
+              const role = cxn.xpr[2].ref;
+              if (operator === "=") {
+                const isValidRole = role == "$user" || ROLES.includes(role);
+                if (!isValidRole) {
+                  context.report({
+                    message: `Invalid \`where\` expression, role \`${role}\` not found.`,
+                    node,
+                    file
+                  });
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+};

package/lib/rules/index.js

@@ -0,0 +1,26 @@
+const Cache = require("../utils/Cache");
+const createRule = require("../utils/createRule");
+
+const rules = {
+  "assoc2many-ambiguous-key": () => createRule(require("./assoc2many-ambiguous-key")),
+  "auth-no-empty-restrictions": () => createRule(require("./auth-no-empty-restrictions")),
+  "auth-use-requires": () => createRule(require("./auth-use-requires")),
+  "auth-valid-restrict-grant": () => createRule(require("./auth-valid-restrict-grant")),
+  "auth-valid-restrict-keys": () => createRule(require("./auth-valid-restrict-keys")),
+  "auth-valid-restrict-to": () => createRule(require("./auth-valid-restrict-to")),
+  "auth-valid-restrict-where": () => createRule(require("./auth-valid-restrict-where")),
+  "latest-cds-version": () => createRule(require("./latest-cds-version")),
+  "min-node-version": () => createRule(require("./min-node-version")),
+  "no-db-keywords": () => createRule(require("./no-db-keywords")),
+  "no-dollar-prefixed-names": () => createRule(require("./no-dollar-prefixed-names")),
+  "no-join-on-draft-enabled-entities": () => createRule(require("./no-join-on-draft-enabled-entities")),
+  "require-2many-oncond": () => createRule(require("./require-2many-oncond")),
+  "sql-cast-suggestion": () => createRule(require("./sql-cast-suggestion")),
+  "start-elements-lowercase": () => createRule(require("./start-elements-lowercase")),
+  "start-entities-uppercase": () => createRule(require("./start-entities-uppercase")),
+  "valid-csv-header": () => createRule(require("./valid-csv-header"))
+};
+
+Cache.set("rules", rules);
+
+module.exports = rules;

package/lib/rules/latest-cds-version.js

@@ -4,22 +4,22 @@ const semver = require("semver");
 module.exports = {
   meta: {
     docs: {
-      description: "Checks whether the latest `@sap/cds` version is being used.",
-      category: "Environment",
-      version: "1.0.4",
+      description: "Checks whether the latest `@sap/cds` version is being used."
     },
     type: "suggestion",
     hasSuggestions: true,
     messages: {
       latestCDSVersion: `A newer CDS version is available!`,
     },
+    severity: "off",
+    model: "none"
   },
   create: function (context) {
-    return { all: check_latest_cds_version };
+    return check_latest_cds_version;
 
     function check_latest_cds_version() {
       let cdsVersions;
-      let e = context.cds.environment;
+      let e = context.getEnvironment();
       if (!e) {
         e = cp
           .execSync(`npm outdated @sap/cds --json`, {
@@ -32,9 +32,10 @@ module.exports = {
         cdsVersions = e["@sap/cds"];
         // If current cds version is not the latest
         if (Object.keys(cdsVersions).length !== 0 && !semver.satisfies(cdsVersions.latest, cdsVersions.current)) {
-          return {
+          context.report({
             messageId: "latestCDSVersion",
-          };
+            node: context.getNode()
+          });
         }
       }
     }

package/lib/rules/min-node-version.js

@@ -4,25 +4,23 @@ const semver = require("semver");
 module.exports = {
   meta: {
     docs: {
-      description: `Checks whether the minimum Node.js version required by \`@sap/cds\` is achieved.`,
-      category: "Environment",
-      recommended: true,
-      version: "1.0.0",
+      description: `Checks whether the minimum Node.js version required by \`@sap/cds\` is achieved.`
     },
-    severity: "error",
+    severity: "off",
     type: "problem",
+    model: "none"
   },
   create: function (context) {
-    return { all: check_min_node_version }
+    return check_min_node_version;
 
     function check_min_node_version() {
-      const e = context.cds.environment;
+      const e = context.getEnvironment();
       let nodeVersion, nodeVersionCDS;
       if (!e) {
         // Get current and required node versions
         try {
           const CDSPath = require.resolve("@sap/cds/package.json", {
-            paths: [path.dirname(context.filePath)],
+            paths: [path.dirname(".")],
           });
           const jsonCDS = require(CDSPath);
           nodeVersion = process.version;
@@ -39,7 +37,10 @@ module.exports = {
         nodeVersionCDS &&
         !semver.satisfies(nodeVersion, nodeVersionCDS, { loose: true })
       ) {
-        return `CDS minimum node version of ${nodeVersionCDS} required, found ${nodeVersion}!`;
+        context.report({
+          message: `CDS minimum node version of ${nodeVersionCDS} required, found ${nodeVersion}!`,
+          node: context.getNode()
+        });
       }
     }
 

package/lib/rules/no-db-keywords.js

@@ -1,35 +1,34 @@
-// TODO: TEST API
-//module.exports = require("../../api").createRule({ // TODO: eliminate that and allow std eslint style module.export = { ...
+const cds = require("@sap/cds");
+
 module.exports = {
   meta: {
     docs: {
       description: `Avoid using reserved SQL keywords.`,
-      category: "Model Validation", //> values are specific for cds lint
-      recommended: true,
-      version: "2.1.0",
+      recommended: true
     },
-    severity: "error" //> convenience option by cds.lint
+    type: "problem"
   },
   create(context) {
-    const { cds } = context //> specific for cds lint
-    const { db = { kind: "sql" } } = cds.env.requires
+    const { db = { kind: "sql" } } = cds.env.requires;
 
-    return { //> return standard eslint visitor callbacks registered to CSN kinds, types, ...
+    return {
+      //> return standard eslint visitor callbacks registered to CSN kinds, types, ...
       entity: check_name_is_not_reserved,
       element: check_name_is_not_reserved
-    }
+    };
 
     function check_name_is_not_reserved(d) {
       if (d.name in RESERVED) {
         // Do not blame in case of external services
-        let srv = d._service || (d.parent && d.parent._service)
-        if (srv && srv["@cds.external"]) return
-
-        // Do blame
-        return `'${d.name}' is a reserved keyword in ${db.kind.toUpperCase()}` //> convenience options by cds lint
+        let srv = d._service || (d.parent && d.parent._service);
+        if (srv && srv["@cds.external"]) return;
+        context.report({
+          message: `'${d.name}' is a reserved keyword in ${db.kind.toUpperCase()}`,
+          node: context.getNode(d)
+        });
       }
     }
-  },
+  }
 };
 
 // REVISIT: Replace by compiler-provided check
@@ -42,5 +41,5 @@ const RESERVED = {
   group: 1,
   LIMIT: 1,
   Limit: 1,
-  limit: 1,
+  limit: 1
 };

package/lib/rules/no-dollar-prefixed-names.js

@@ -1,49 +1,23 @@
-const { isVSCodeEditor } = require("../utils/helpers");
-
 module.exports = {
   meta: {
     docs: {
       description: `Names must not start with $ to avoid possible shadowing of reserved variables.`,
-      category: "Model Validation",
-      recommended: true,
-      version: "2.3.3",
+      recommended: true
     },
-    severity: "warn",
+    type: "problem"
   },
   create(context) {
     return { element: _check };
 
     function _check(d) {
-
-      // Do not blame in case of external services
       let srv = d._service || (d.parent && d.parent._service);
       if (srv && srv["@cds.external"]) return;
-
-      const results = [];
-      for (const m in context.cds.model.messages) {
-        const msg = context.cds.model.messages[m];
-        if (msg.messageId === "syntax-dollar-ident" && !isVSCodeEditor()) {
-          results.push({
-            message: msg.message,
-            loc: {
-              start: { line: msg.location.line, column: msg.location.col - 1 },
-              end: {
-                line: msg.location.endLine,
-                column: !msg.location.endCol
-                          ? context.sourcecode.lines[msg.location.line - 1].length 
-                          : msg.location.endCol - 1,
-              },
-            },
-            file: msg.location.file,
-          });
-        }
-      }
-
       if (d.name.startsWith("$")) {
-        // Do blame
-        results.push(`“${d.name}” is prefixed with a dollar sign ($)`);
+        context.report({
+          message: `“${d.name}” is prefixed with a dollar sign ($)`,
+          node: context.getNode(d)
+        });
       }
-      return results.length > 0 ? results : undefined;
     }
-  },
+  }
 };

package/lib/rules/no-join-on-draft-enabled-entities.js

@@ -2,39 +2,24 @@ module.exports = {
   meta: {
     docs: {
       description: `Draft-enabled entities shall not be used in views that make use of \`JOIN\`.`,
-      category: "Model Validation",
-      recommended: true,
-      version: "2.2.1",
+      recommended: true
     },
-    severity: "warn",
     type: "suggestion",
-    messages: {
-      noJoinOnDraftEnabledEntities: `Do not use draft-enabled entities in views that make use of \`JOIN\`.`,
-    },
+    model: "inferred"
   },
   create: function (context) {
-
-    return { entity: check_nojoin_draftenabled }
+    return { entity: check_nojoin_draftenabled };
 
     function check_nojoin_draftenabled(e) {
       if (e["@odata.draft.enabled"]) {
         if (e.query.SELECT.from.join) {
-          const location = e.query.$location;
-          if (context.sourcecode.lines[location.line - 1]) {
-            const endCol = context.sourcecode.lines[location.line - 1].length;
-            const loc = {
-              start: { line: location.line, column: location.col - 1 },
-              end: { line: location.line, column: endCol },
-            };
-            return {
-              messageId: "noJoinOnDraftEnabledEntities",
-              loc,
-              file: e.$location.file,
-            };
-          }
+          context.report({
+            message: `Do not use draft-enabled entities in views that make use of \`JOIN\`.`,
+            node: context.getNode(e),
+            file: e.$location.file
+          });
         }
       }
     }
-
-  },
+  }
 };

package/lib/rules/require-2many-oncond.js

@@ -2,26 +2,21 @@ module.exports = {
   meta: {
     docs: {
       description: `Foreign key information of a \`TO MANY\` relationship must be defined within the target and specified in an \`ON\` condition.`,
-      category: "Model Validation",
-      recommended: true,
-      version: "2.1.0",
+      recommended: true
     },
-    severity: "error",
-    type: "problem",
+    type: "problem"
   },
   create: function (context) {
-
-    return { element: check_2many_oncond }
+    return { element: check_2many_oncond };
 
     function check_2many_oncond(e) {
-      if (e.is2many && !e.on && typeof e.target === 'string') {
-        const loc = context.cds.getLocation(e.name, e);
-        return {
+      if (e.is2many && !e.on && typeof e.target === "string") {
+        context.report({
           message: `You must provide an \`ON\` condition for \`TO MANY\` relationship '${e.name}'.`,
-          loc,
-          file: e.parent.$location.file,
-        };
+          node: context.getNode(e)
+        });
       }
     }
-  },
+
+  }
 };